The vulnerability exists in the @n8n/workflow-sdk node-schema loader, which builds a node’s schema module path from an attacker-supplied node type string without validating path‑traversal sequences. An authenticated user with global:member privileges can supply a malicious node type that points to arbitrary files on the server, causing the n8n main process to execute that file. This flaw is a classic file‑path traversal weakness identified as CWE‑22 and can lead to complete compromise of the server hosting the n8n instance.

All instances of n8n managed by n8n‑io with versions earlier than 2.33.4, and all 2.34.x releases before 2.34.1, are vulnerable. The affected product is the n8n workflow automation platform provided by n8n‑io; any deployment using these versions must be verified to be patched or upgraded.

The CVSS score of 8.7 indicates high severity, and while EPSS data is not available, the lack of mention in the CISA KEV catalog does not diminish the risk. The vulnerability requires authentication with at least global:member rights, meaning that any compromised account or mis‑assigned privileges could trigger remote code execution. Given the critical nature of this flaw and the potential for complete system compromise, the risk is considered severe and the exploitation likelihood is non‑negligible in environments where administrative or global‑member accounts exist.